MALICIOUS — FlatOut + hack.exe

MALICIOUS — FlatOut + hack.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1d4a04a2e0e9f9dc4ad597c54f8be86f7d10d4e95b957d7ab5b3671f46029a45
SHA-1: 966a5e65c11941959ab4b8604a5ab5b1ecaab7ec
MD5: 10ea28102e9dbdff6e6caba2c59faf2e
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2OO:blN9RkkkkkkTLSBvyM
TLSH: T1723AD040717A398CCB309F511924594DA12152C2CA7D3DDB9B030B2D2D7B8BBB8E8E76
Submitted as: FlatOut + hack.exe
File type: pe · Size: 100459 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (HUILoader): Half-Life 2 trainer.exe - dynamic signal, weight 0.62, confidence 0.90
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 880) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

1542 behavior events · 0 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Windows\win32dc\Half-Life 2 trainer.exe - c354c4bf2892e291c7d538da2536933ac06cca4ea9e6ee913a6fe2ee7aef86f2
C:\Windows\win32dc\DAoC_hack.exe - ec8997b8d94caf0931d540aad07476a2f511937da0b05263cd3db1d7dab14f50
C:\Windows\win32dc\BattleField 1942_trainer.exe - f30bc0e2e16c58319238fea892e0dd1727a5668580f855c58a9ed8861e13b211
C:\Windows\win32dc\Silent Hill 4 + codes.exe - 0da520bad7c4817f366e4ef1c729f8128f671c7ff89eba271b111bc1c4b1f27d
C:\Windows\win32dc\FlatOut + codes.exe - f57882a7927fd5655f0090ec6c0da275c3d7b6e802842ed014f531630e541135
C:\Windows\win32dc\Half-Life 2(hack).exe - abaed2a32bf63041ce5c1a78a46c35fc0b802e4ee30d36abffbb65a5a00ea1d2
C:\Windows\win32dc\Quake3 nocd.exe - 741947cd7cf489b82afeb62a4eb151a3e9318457de825e28e2c867d60e31c79b
C:\Windows\win32dc\Doom 3_fix.exe - 83177e49be0806661067a3a64132d1f002a9362a4ef27a449c843ab883d234c8
C:\Windows\win32dc\Counter-Strike(nocd).exe - d409fb92371a8d7167e50c9548b386b93c982044fc9a58d204667413e9d3f2d5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787636817&P2=404&P3=2&P4=TbTEpeBeFKW9KJEp4zZG%2ffrfJAP%2f5jjPeIbokVd0sduFZosij7hMBrIsf%2bgQJo%2fLT51dK%2b7dj8TkPCvtM8s8Ng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787636871&P2=404&P3=2&P4=Lq63KbR9eq1vKpYVBGXv4SHb8SRDMsKYHFu4ygTrmBX4t8eiKLn47Lo9IBD%2b1w7yEjzsUImQ%2bcoaX2zgLSwv5w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

20.42.65.85
4.230.171.124
48.211.4.16
52.230.59.222
74.178.76.128
20.184.175.5
135.232.92.97
52.123.129.14
20.76.201.171
40.99.133.226
135.233.45.221
52.123.252.229
203.26.79.13
52.123.252.223
135.233.95.80
199.71.214.87
52.148.114.188
4.150.223.98
48.199.12.1
52.110.12.4
72.145.35.102
52.110.12.16

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report